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It is hereby agreed by the Accused, Defense Counsel, and Trial Counsel, that if Mr. 
James Fung were present to testify during the merits and pre-sentencing phases of this court- 
martial, he would testify substantially as follows: 

1. I currently work as the supervisor of the Cyber Security Operations Group at Brookhaven 
National Laboratory (BNL) in Upton, New York. This Group is responsible for the security 
posture of BNL and is constituted by one physical site where multiple BNL departments' IT 
directorates centralize their security operations. As supervisor, I oversee the daily operations of 
this Group. These operations include intrusion detection, audit log collections, and Cyber 
Security Incident Response Team (CSIRT) activities. Audit log collection entails collecting 
electronic audit logs, which track the time/date and user activities of individuals using BNL 
computers. These logs are used to analyze the BNL system for security vulnerabilities and also 
to secure data regarding suspected security violations. The CSIRT team is responsible for 
detecting, responding to, and investigating cyber security violations as well as pursuing 
allegations of fraud, waste, and abuse. In its work, we collaborate with the BNL human 
resources department, on-site security, and law enforcement. I have held my supervisory 
position for six years. I have a Bachelors degree in IT Management and am certified as a 
Forensic Analyst by the computer security professional association Global Information 
Assurance Certification (GIAC). 

2. I first became involved in this case after CSIRT members, whom I supervise, alerted me that 
the desktop work station computer of a BNL employee identified as Mr. Jason Katz had been 
used contrary to BNL policy. To investigate this suspected misuse, two members of the CISRT 
team collected Mr. Katz's BNL desktop computer. Based on BNL's report to federal law 
enforcement officials, investigators in the present case against PFC Manning became interested 
in the contents of the BNL desktop computer assigned to Mr. Katz, which my team collected. 
No rationale for this interest was communicated to me. 

3. Mr. Katz worked as a Systems Administrator for the Physics Department at BNL. He was 
hired as a Junior Systems Administrator, and was employed from February of 2009 until March 
of 2010. His primary responsibilities were to help maintain the computers that processed data 
for our Relativistic Heavy Ion Collider (RHIC) as well as the ATLAS Computing facility 
(RACF). As BNL has the capacity to process large amounts of data through our super computer 
systems, Mr. Katz was further responsible for helping to manage the queue of jobs submitted 
from institutions throughout the world, who seek BNL's assistance in processing large amounts 
of data. For example, research universities send large amounts of research data to us, as our 
facility can process data with the power of five hundred computers. 
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4. Our CSIRT team became suspicious of Mr. Katz when his desktop computer was removed 
from our BNL network. This happens automatically when our system detects that the BNL 
computer attached to this account is used in a way that violates BNL user agreements. When a 
machine is blocked or disconnected from our BNL network, it is no longer usable - including for 
work purposes. Mr. Katz approached our office to have his desktop reconnected to the 
network — alleging that he had been kicked off after accidentally clicking a prohibited link in an 
email on his personal account. Following this explanation, we reconnected his computer to the 
network. However, upon considering the matter further, I decided this was unlikely given the 
activity detected. Accordingly, I notified our Laboratory Protective Division (LPD), legal 
department, and human resources office of the suspicious activity and initiated an investigation. 
Subsequently, an armed LPD officer was dispatched to Mr. Katz's office. I further dispatched 
two members of my CSIRT team to respond. Mr. Withers was part of the CSIRT team. He was 
the team member to first identify the suspicious activity associated with Mr. Katz's BNL desktop 
computer. Further, given Mr. Withers prior BNL work in the same section as Mr. Katz, I 
considered Mr. Withers knowledgeable about Mr. Katz's official duty position. After collecting 
Mr. Katz's computer, Mr. Withers delivered the machine to our secure forensic laboratory to be 
forensically imaged by Mr. McManus. 

6. Access to our forensic laboratory is secured by access key card. Only members of our Cyber 
Security Group have this access. Further, the lab contains a safe used to house evidence 
securely. This safe can only be accessed when a key and pass code are used in conjunction. 
Only two people hold this key - myself and a colleague, who is also a member of the Cyber 
Security Group. Only members of the Cyber Security Group have pass codes to the safe. 

7. Later my team searched the forensic image created by Mr. McManus. Our search revealed 
the presence of password cracking programs, which are commonly used to break file passwords. 
To the best of my knowledge, there is no reason Mr. Katz would need these programs for work 
purposes. I later confirmed this understanding with Mr. Katz's then-supervisor Mr. Chan. I do 
not recall seeing anything related to WikiLeaks on Mr. Katz's computer. This would have been 
before I had heard of WikiLeaks, so I do not know if I would remember it if I did. 

8. At no point during the detection of suspicious activity or the ensuing investigation and 
examination did I alter Mr. Katz's BNL computer, its hard drive, its other components, or its 
contents in any way. Furthermore, I never altered any forensic image made from this computer in 
any way. At no point did I observe anyone alter the computer, its hard drive, its other 
components, or it contents in any way. Likewise, I have no reason to believe the evidence was 
damaged or contaminated in any way. 
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